National security is an area of such significance for Member States that art.4(2) TEU considers its safeguarding part of their “essential … functions”. As is the case with other policy areas, ranging from social security and health care to the organisation of the armed forces, political sensitivity does not remove domestic actions from the scope of EU law altogether. Instead, Member States are required to enjoy their discretion in compliance with EU law and in accordance with the exceptions that are laid down in primary law.
How is the balance between the right of the Member States to protect their national security and the requirement that they comply with EU law to be struck? An emerging terrain where this question has arisen is set out in Privacy International (C-623/17) and La Quadrature du Net (C-511/18, C-512/18 and C-520/18). The ECJ held that neither art.4(2) TEU nor the security exception laid down in art.15(3) of Directive 2002/58 on privacy and electronic communications exclude from the scope of EU law national legislation imposing upon providers of electronic communications services the duty to retain or transmit to competent national authorities traffic and location data for security purposes. It was held that domestic legislation requiring the general and indiscriminate retention of such data would be consistent with arts 7, 8, 11 and 52(1) of the Charter of Fundamental Rights only if necessary for safeguarding national security and provided that a number of substantive and procedural guarantees were met. On the other hand, safeguarding other interests, such as combatting serious crime and preventing serious threats to public security may be protected by less rigorous measures such as the targeted retention of such data.
The main thrust of the issues that the above judgments raise is not novel: not only does the internal market law give domestic authorities leeway to protect the different guises that public interest may take, but even in relation to “the essential interests of [a Member State’s] security” there is now a body of case-law which seeks to strike the balance between national powers and EU law.5 What is new about the issues raised in the Quadrature du Net judgment is the specific context: a new type of subject matter, a new way of restricting EU rules protecting this subject matter, and a new understanding of what security is about. In fact, so controversial is this context that, in its response to the ECJ judgment, the Conseil d’Etat envisaged a situation where the domestic courts might be entitled to disregard the relevant EU constraints.
Let us focus on the concept of national security. The distinction between it and “public security” is crucial as it is the former that may justify the most onerous national restrictions. Whilst of a more narrow scope and describing an interest of a higher order than the latter, national security is inherently ambiguous. Again, that is by no means novel in EU law. The notion of public security, for instance, has been construed in the context of free movement of citizens in such a dynamic manner as to be viewed to encompass aspects of public policy(...)